Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8b1bee8254ec738…

MALICIOUS

PDF

43.8 KB Authoring application: ImageMagick
MD5: 3af0c29586b9ba4d2fe12b6397111cd3 SHA-1: 3e2c66ed1fe6222a13a56ee46e40610eccb31870 SHA-256: b8b1bee8254ec738e9ab901228580db7984ba76f22c2e810ab7bd3a9a49103fb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF documents, indicating a link farm or redirection strategy. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic-generating intent. The embedded URLs are likely used to direct users to malicious content or further phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://moralguard.com/uploads/1/3/0/7/130738697/kajipike_dolovidexaxikut_fopebaputef_wolelogawadiduf.pdf
    • http://pakfitness.ca/uploads/1/3/0/6/130639567/2469812.pdf
    • http://anuqa.net/uploads/1/3/0/6/130639061/tekupisupifagosujur.pdf
    • http://corazondemujer.net/uploads/1/3/0/6/130604512/3b1f408cd476c33.pdf
    • http://fukuwaz.motivationluxury.com/uploads/2020/01/28/773472.pdf
    • http://nmtitlesolutions.com/uploads/1/3/0/6/130621998/08c2c03.pdf
    • http://newminerigs.com/uploads/1/3/0/5/130590741/xuxuxilawo-somozag-zejigud-fezit.pdf
    • http://thecraftroomomaha.com/uploads/1/3/0/6/130621853/vonavur-paviwanele-wikidani-waveb.pdf
    • http://nzbriards.com/uploads/1/3/0/5/130551720/jegaf.pdf
    • http://naturalhand.net/uploads/1/3/0/5/130590026/xagikun.pdf
    • http://aearthsport.com/uploads/1/3/0/6/130640004/zonatamebe.pdf
    • http://rebeccalaplacaattia.com/uploads/1/3/0/6/130621487/130621487.html#design+template+definition+computer

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012f2.bin
daf3f966c3be90815cde6fdeb9cf9bbc4ecc057fd24eabb09febde6327638d91		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F2 8312 bytes
font_01_sfnt_off00006522.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6522 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.